> but I don't think "oh no, HTTPS handshakes are 20% slower!" is something we should actually worry about.
Why not? TLS handshakes are real. That said, we have pretty restrictive TCP windows from 20+y ago that might need a bump-up at som point.
But importantly, we should not be making too many assumption on use-cases, as if stateful connections like TLS is the holy grail. Small and fast crypto enables new use-cases - engineering standards should always take perf & overhead into account, and not focus only on existing use.
> The real worry is all of the small, secure, embedded devices that literally don't have enough memory or compute to run these algorithms at all.
Indeed! And more overhead increases surface area for DOS attacks on “high-end devices” as well. So there are already clear examples of how these would break important things.
The reason I’m skeptical is precisely that QR today has known, significant setbacks, but unknown benefits.
Why not? TLS handshakes are real. That said, we have pretty restrictive TCP windows from 20+y ago that might need a bump-up at som point.
But importantly, we should not be making too many assumption on use-cases, as if stateful connections like TLS is the holy grail. Small and fast crypto enables new use-cases - engineering standards should always take perf & overhead into account, and not focus only on existing use.
> The real worry is all of the small, secure, embedded devices that literally don't have enough memory or compute to run these algorithms at all.
Indeed! And more overhead increases surface area for DOS attacks on “high-end devices” as well. So there are already clear examples of how these would break important things.
The reason I’m skeptical is precisely that QR today has known, significant setbacks, but unknown benefits.